CVE-2026-68390

HighCVSS 8.8

Published: 10/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

In the Linux kernel's Bluetooth subsystem (hci_sync), an issue was found where hdev->lock is not held during hci_conn_params lookups. Without this lock, list iteration or parameter access is not safe. The fix adds hdev->lock for parameter lookups.

Risk Assessment

This could lead to data races and potentially system crashes.

Recommendation

Install a Linux kernel update containing the fix that adds hdev->lock for parameter lookups.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups hci_conn_params_lookup requires hdev->lock be held, otherwise the list iteration or param access is not safe. Hold hdev->lock for params lookups in hci_sync.